added permissions model, controller and tests